What is the CVSS score of CVE-2026-34838?

CVE-2026-34838 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft are affected by CVE-2026-34838?

Group-Office CRM versions prior to 6.8.156, 25.0.90, and 26.0.12 contain a critical remote code execution vulnerability exploitable by authenticated users with low-level access, enabling arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-34838?

Within 24 hours: Inventory all Group-Office CRM deployments and document current versions. Within 7 days: Upgrade to patched versions (6.8.156, 25.0.90, or 26.0.12 depending on deployment branch) and verify patch installation. Within 30 days: Conduct access review of Group-Office user accounts, implement principle of least privilege for system accounts, and enable enhanced logging on deserialization events.

Microsoft CVE-2026-34838

EUVD-2026-18532 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-02 GitHub_M

RCE Deserialization Microsoft

9.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.8.156,26.0.12,25.0.90

EUVD ID Assigned

Apr 02, 2026 - 19:31 euvd

EUVD-2026-18532

Analysis Generated

Apr 02, 2026 - 19:31 vuln.today

CVE Published

Apr 02, 2026 - 19:15 nvd

CRITICAL 9.9

DescriptionNVD

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

AnalysisAI

Remote Code Execution in Group-Office enterprise CRM via insecure deserialization allows authenticated attackers to write arbitrary files and execute code on the server. Affects all versions prior to 6.8.156, 25.0.90, and 26.0.12 across multiple product branches. …

RemediationAI

Within 24 hours: Inventory all Group-Office CRM deployments and document current versions. Within 7 days: Upgrade to patched versions (6.8.156, 25.0.90, or 26.0.12 depending on deployment branch) and verify patch installation. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-10044 HIGH This Week POC

8.2 May 28

{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat

CVE-2026-40412 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil

CVE-2026-41104 CRITICAL Monitor

10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal

CVE-2026-23652 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-

CVE-2026-47280 CRITICAL Monitor

10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti

CVE-2026-34838 vulnerability details – vuln.today

Back

Microsoft CVE-2026-34838

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Share

External POC / Exploit Code